Bug in handling user certifications for specific contexts?

[David Walker]

I'll also point out that this is not really what I understand as "step
up," as the Password and Duo parts of the authentication may not be
performed for the same SP.

David


On 09/09/2015 08:53 AM, Cantor, Scott wrote:
> On 9/9/15, 11:41 AM, "dev on behalf of Tom Scavo" <dev-bounces at shibboleth.net on behalf of trscavo at internet2.edu> wrote:
>
>> On Wed, Sep 9, 2015 at 11:22 AM, Wessel, Keith <kwessel at illinois.edu> wrote:
>>> Is there anything that can be done (or added) to tell a flow to first run another flow to get the needed principal before proceeding?
>> I won't go so far as to suggest that what you're doing is wrong but
>> recall that an SP can include a NameID in the AuthnRequest. I'm
>> guessing this is precisely the use case that feature was intended to
>> address.
> The problem here is that it's *not* just about getting the user identity, it also involves assumptions that something login-related happened that isn't formally part of the login method in question. I think that's a problematic model in general that makes method selection based on complex rules very hard to get right.
>
> The very fact that the Duo method is being configured to support the password SAML context class is a sign that something's wrong to me. I think to do that, the Duo method has to itself encompass use of passwords at the end of the day.
>
>> Btw, including a NameID in the AuthnRequest is the precise definition
>> of "Step-Up Authentication."
> Well, I don't think SAML has such a concept, but that's one component (which nothing much but Shibboleth implements, and really only at the IdP at that) that could be used to implement it.
>
> -- Scott
>